CVE-2026-64577 is a vulnerability in Linux Kernel
Published on August 5, 2026
gtp: check skb_pull_data() return in gtp1u_send_echo_resp()
In the Linux kernel, the following vulnerability has been resolved:
gtp: check skb_pull_data() return in gtp1u_send_echo_resp()
gtp1u_send_echo_resp() ignores skb_pull_data()'s return value. Its
caller gtp1u_udp_encap_recv() only guarantees 16 bytes (udphdr +
gtp1_header), but the pull requests 20 (gtp1_header_long + udphdr). For
a 16-19 byte echo request the pull fails and returns NULL without
advancing skb->data; execution continues, and the following skb_push()
plus the IP header pushed by iptunnel_xmit() move skb->data below
skb->head, tripping skb_under_panic().
Fix it by dropping the packet when skb_pull_data() fails.
skbuff: skb_under_panic: ...
kernel BUG at net/core/skbuff.c:214!
Call Trace:
skb_push (net/core/skbuff.c:2648)
iptunnel_xmit (net/ipv4/ip_tunnel_core.c:82)
gtp_encap_recv (drivers/net/gtp.c:701 drivers/net/gtp.c:808 drivers/net/gtp.c:920)
udp_queue_rcv_one_skb (net/ipv4/udp.c:2388)
...
Kernel panic - not syncing: Fatal exception in interrupt
Products Associated with CVE-2026-64577
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 9af41cc33471ea1efa6f77e188f055cc77d0a5c5 and below b3c733eaae7f362601c28ac1533d47a961cd3e1c is affected.
- Version 9af41cc33471ea1efa6f77e188f055cc77d0a5c5 and below 4fc7923871d176ce0e5fecf4a9b7bb915af790ed is affected.
- Version 9af41cc33471ea1efa6f77e188f055cc77d0a5c5 and below 961e9b1e33445f8e42859ecc020c9f60d8b69a8b is affected.
- Version 9af41cc33471ea1efa6f77e188f055cc77d0a5c5 and below cf45d748e437b8dd2dd987f27ee79c8c86f95c88 is affected.
- Version 9af41cc33471ea1efa6f77e188f055cc77d0a5c5 and below cd170f051dba9ac146fabcd1b91726487c0cb9fa is affected.
- Version 5.18 is affected.
- Before 5.18 is unaffected.
- Version 6.6.148, <= 6.6.* is unaffected.
- Version 6.12.101, <= 6.12.* is unaffected.
- Version 6.18.42, <= 6.18.* is unaffected.
- Version 7.1.6, <= 7.1.* is unaffected.
- Version 7.2-rc5, <= * is unaffected.